API

All endpoints live on app.decoy.run under /api/. The full, machine-readable spec is always at:

GET https://app.decoy.run/api/openapi.json

This page highlights the endpoints most integrations use. Every request authenticates with a bearer token from your dashboard.

Base URL

https://app.decoy.run

curl -H "Authorization: Bearer $DECOY_TOKEN" https://app.decoy.run/api/triggers

Core endpoints

Triggers & agents

• GET /api/triggers — recent tripwire trigger events
• GET /api/triggers/export — export as CSV or JSON
• GET /api/agents — connected agents with fingerprint, status, last seen
• PATCH /api/agents — pause, resume, or revoke an agent

Threat intel (Pro+)

• GET /api/feed — structured JSON threat feed. Filter by category, severity, source, and date range.

Scans

• POST /api/scan/upload — upload scan results to your workspace
• GET /api/scan/history — list past scans
• GET /api/scan/results — fetch a specific scan
• GET /api/scan/schedule / POST /api/scan/schedule — continuous scanning (Business tier)

Red team (Pro+)

• POST /api/redteam/plan — generate an attack plan from scan results
• POST /api/redteam/iterate — adapt attacks based on responses
• POST /api/redteam/fix — suggested remediations
• GET /api/redteam/history / GET /api/redteam/results

Workspace

• GET /api/config / PATCH /api/config — alert configuration
• GET /api/tokens / POST /api/tokens / DELETE /api/tokens — API tokens
• GET /api/risk — rollup risk score for your workspace
• GET /api/billing — current plan and limits

Rate limits

Limits are per-token and per-tier. Current values are returned in X-RateLimit-* response headers on every call.

Authentication errors

Missing or invalid tokens return 401 with:

{ "error": "Invalid token. Get a valid token at https://decoy.run or via POST /api/signup" }

Grab a token from the dashboard or create one with POST /api/signup (email required, no credit card for Free).